Why this matters
Parsing untrusted JSON without validation can result in runtime errors or vulnerabilities. Always validate the structure of parsed JSON to ensure it meets expected requirements.
Ensure that JSON data is validated before parsing. Parsing untrusted JSON without validation can result in runtime errors or vulnerabilities.
Parsing untrusted JSON without validation can result in runtime errors or vulnerabilities. Always validate the structure of parsed JSON to ensure it meets expected requirements.
Side-by-side examples engineers can pattern-match during review.
const data = JSON.parse(userInput); // No validationtry {
const data = JSON.parse(userInput);
if (typeof data !== 'object' || Array.isArray(data)) {
throw new Error('Invalid JSON structure');
}
} catch (err) {
console.error('JSON parsing error:', err);
}
const data = JSON.parse(userInput); // No validationtry {
const data = JSON.parse(userInput);
if (typeof data !== 'object' || Array.isArray(data)) {
throw new Error('Invalid JSON structure');
}
} catch (err) {
console.error('JSON parsing error:', err);
}
From the same buckets as this rule.
Check if loops use equality operators (== or !=) in termination conditions. These can lead to infinite loops if the condition is never met exactly. Instead, use relational operators like < or > for safer loop termination.